---

id: "PM-08" title: "Critical Infrastructure Plan" family: "PM" family_name: "Program Management" sort_id: "pm-08" priority: "P1" implementation_level: "organization"

---

Statement

Address information security and privacy issues in the development, documentation, and updating of a critical infrastructure and key resources protection plan.

Guidance

Protection strategies are based on the prioritization of critical assets and resources. The requirement and guidance for defining critical infrastructure and key resources and for preparing an associated critical infrastructure protection plan are found in applicable laws, executive orders, directives, policies, regulations, standards, and guidelines.

Assessment Objective: information security issues are addressed in the development of a critical infrastructure and key resources protection plan;

Assessment Objective: information security issues are addressed in the documentation of a critical infrastructure and key resources protection plan;

Assessment Objective: information security issues are addressed in the update of a critical infrastructure and key resources protection plan;

Assessment Objective: privacy issues are addressed in the development of a critical infrastructure and key resources protection plan;

Assessment Objective: privacy issues are addressed in the documentation of a critical infrastructure and key resources protection plan;

Assessment Objective: privacy issues are addressed in the update of a critical infrastructure and key resources protection plan.

Information security program plan

privacy program plan

critical infrastructure and key resources protection plan

procedures addressing the development, documentation, and updating of the critical infrastructure and key resources protection plan

HSPD 7

National Infrastructure Protection Plan

other relevant documents or records

Organizational personnel with information security and privacy program planning and plan implementation responsibilities

organizational personnel responsible for developing, documenting, and updating the critical infrastructure and key resources protection plan

organizational personnel with information security and privacy responsibilities

Organizational processes for developing, documenting, and updating the critical infrastructure and key resources protection plan

mechanisms supporting the development, documentation, and updating of the critical infrastructure and key resources protection plan